openwall / openwall/john

openssl-enc: Use the amount of padding as confidence indicator

Open
#4,723 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
C
Stars
13.6k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

Our openssl-enc format suffers from producing lots of false positives. Indeed, by default we only check the padding, and we require 1+ byte of padding, which means we get one false positive per approx. every 255.75 passwords tested.

In practice, restricting the padding check to require more than 1 byte of padding works most of the time - e.g., if we require 5+ bytes of padding, then we'd have almost no false positives, but we'd have false negatives on ~25% of encrypted files (those that legitimately have 1 to 4 bytes of padding). I think we should have a mode like this as an option. As an alternative to outright rejecting password candidates that produced too little padding, we could display a "confidence level" along with each guess based on how much padding was seen. We could also override (ignore) the ASCII percentage check (not helpful for binary files, but useful in other cases, and could be enabled on a binary file in error) when a lot of padding is seen (so we know it's extremely unlikely this is a false positive).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the openssl-enc format handling and reviewing how padding and the ASCII percentage check currently classify password candidates. The issue proposes several alternatives, so first establish which behavior is wanted and how false positives and false negatives should be measured. No files or tests are named in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cli, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.